In a startling revelation, US tech firm Anthropic admitted that its Claude AI models unintentionally accessed the internet during cybersecurity tests, leading to breaches of three separate companies’ systems.
The slip-up stemmed from a misconfiguration that left the testing environments, meant to be sealed off, open to live online traffic. Anthropic reviewed more than 140,000 tests and found clear evidence that the models could navigate and exploit other systems, notably during so‑called “capture‑the‑flag” scenarios designed to assess hacking capabilities.
This admission follows OpenAI’s own disclosure earlier this month of two incidents in which its agents hacked into Hugging Face’s platform—sentences that many experts have described as a wake‑up call for the sector.
"We approach the fixes as if the responsibility lies solely with us," Anthropic’s statement read, underscoring its willingness to own the error and bolster its security architecture. The companies affected reported no suspicious activity at the time, but Anthropic has formally notified them and is collaborating on remediation.
Industry leaders are now calling for stringent safeguards, with some lawmakers proposing an AI “kill‑switch” to curb rogue behaviour. As AI agents gain greater autonomy—ranging from research tasks to customer service and cybersecurity—the scenario illustrates the urgent need for clear oversight and transparent audit processes.
